# Bitwarden vs 1Password in 2026: which password manager to pick

> A direct comparison of Bitwarden and 1Password on price, security architecture, self-hosting and recent incidents, to help you decide which password manager earns a place in your browser.

Published: 2026-10-08 · By: The Security Desk

A password manager is infrastructure you trust with everything else, so the choice between [Bitwarden](https://bitwarden.com/?utm_source=guides.reviews&utm_medium=referral&utm_campaign=comparison) and [1Password](https://1password.com/?utm_source=guides.reviews&utm_medium=referral&utm_campaign=comparison) is less about which app looks nicer and more about which tradeoffs you can live with. Bitwarden is open source, self-hostable, and has a genuinely usable free tier. 1Password is closed source, cloud-only, and costs more at every tier, but it has no free plan to dilute the pitch and a longer track record of polish. We compared both on their own pricing pages and public security documentation rather than on review-site summaries, because the two disagree with each other more often than either vendor's own site does.

## Price

Bitwarden's free plan is the real difference between these two companies. It gives unlimited devices and unlimited saved items, syncing across desktop, mobile and browser, with no feature wall pushing you toward a paid tier for basic use. Bitwarden Premium adds an integrated authenticator, 5GB of encrypted file storage, emergency access and vault health reports for 1.65 dollars a month, billed annually at 19.80 dollars a year. 1Password has no free tier at all, only a 14-day trial; its Individual plan runs 2.99 dollars a month as a new-customer promotional rate (3.99 dollars a month at the regular renewal price), with 1GB of storage included. For households, Bitwarden Families covers six accounts for 3.99 dollars a month (47.88 dollars a year); 1Password Families covers five people at a promotional 4.49 dollars a month (5.99 dollars regular). At the team level, Bitwarden Teams runs 4 dollars per user per month billed annually and Bitwarden Enterprise runs 6 dollars per user per month annually, with Enterprise throwing in a free Families plan for every employee. 1Password's Business tier is 8.99 dollars per user per month (107.88 dollars per user annually) on its own official pricing page, and its small-team option, the Teams Starter Pack, is a flat 24.95 dollars a month for up to 10 members with additional seats at 4.99 dollars each. On pure price, Bitwarden wins at every tier we checked.

## Security architecture

Both companies use zero-knowledge, end-to-end encryption, meaning neither can read your vault contents on its servers. The difference is in how each gets there and how you can verify it. Bitwarden's client and server code is fully open source, so anyone can read the encryption implementation rather than trust a claim about it; the company has also commissioned third-party assessments, including a 2022 penetration test and source code audit from Insight Risk Consulting and a 2023 follow-up from Cure53. 1Password's architecture adds a locally generated Secret Key that combines with your master password before anything is sent to its servers, which the company says means that even a full server compromise plus a stolen master password is not enough to decrypt a vault without that key, which never leaves your devices. 1Password is SOC 2 Type 2 certified and says its audit reports are available on request, but its client code is closed source, so you're trusting the company's account of its own design rather than reading it yourself. Security researchers at ETH Zurich studied password managers under a malicious-server threat model and 1Password says the paper did not surface attack vectors beyond what its own published security whitepaper already discloses.

## Self-hosting and deployment

This is the starkest structural difference between the two. Bitwarden supports self-hosting on your own infrastructure, including a lightweight community option (Vaultwarden) that runs in a small Docker container and stays compatible with every official Bitwarden app and browser extension; Bitwarden's own paid Enterprise tier also offers an official self-hosted deployment. 1Password has never offered self-hosting. Company staff have said on its community forum that self-hosting the membership service could be a future option and that they are gathering demand for it, but as of this comparison it is not available at any price. If your organization has a hard requirement that vault infrastructure stay on hardware you control, Bitwarden is the only one of the two that can say yes today.

## Recent incidents

No password manager is risk-free, and how a vendor handles an incident matters as much as whether one happens. In April 2026, a malicious version of the Bitwarden CLI npm package (version 2026.4.0) was briefly distributed through npm, tied to a broader supply-chain campaign that also hit the security vendor Checkmarx. The payload targeted developer secrets, such as GitHub and npm tokens, SSH keys and cloud credentials, on machines that installed that specific package during a roughly 90-minute window. Bitwarden's own investigation found no evidence that end-user vault data, production systems or production data were affected; the compromise was confined to the npm-distributed CLI tool, not the browser extension, desktop app, or vault service most users actually rely on. Anyone who installed the CLI from npm during that window should still rotate any exposed developer credentials. We have not found a comparable 2026 incident disclosed for 1Password's own infrastructure, though the broader password manager category has had serious breaches before, most notably at LastPass in 2022, which is a useful reminder that this is an industry-wide risk, not a reason to single out either Bitwarden or 1Password specifically.

## Which should you pick

| | Bitwarden | 1Password |
|---|---|---|
| Free plan | Yes, unlimited devices and items | No, 14-day trial only |
| Individual paid | $1.65/mo ($19.80/yr) | $2.99 to $3.99/mo |
| Family plan | $3.99/mo for 6 users | $4.49 to $5.99/mo for 5 users |
| Business/Teams | $4 to $6/user/mo annually | $8.99/user/mo ($2.49 to $24.95/mo for small Teams Starter Pack) |
| Source code | Fully open source | Closed source |
| Self-hosting | Yes, official and community options | No |
| Independent audits | Insight Risk Consulting (2022), Cure53 (2023) | SOC 2 Type 2, reports on request |

If you want the cheapest competent option, or you specifically want to self-host or audit the code yourself, Bitwarden is the clear pick, and its free tier alone is good enough for most individual users with no real downside. If you want a more polished native experience, don't mind paying for it, and like the idea of a locally held Secret Key as a second factor baked into the architecture, 1Password earns its higher price for people who will actually feel the UI difference day to day. For small businesses on a budget, Bitwarden Teams at 4 dollars per seat is hard to argue with. For businesses that already standardize on other 1Password-adjacent tooling or want built-in SIEM event streaming and more mature admin reporting at the Business tier, the extra cost may be worth it.

## Verdict

We'd default most people, and especially anyone cost-conscious or privacy-minded, to Bitwarden: the free tier removes any reason to delay adopting a password manager, the open source code backs up its security claims, and self-hosting is there if you ever want it. We'd only steer someone toward 1Password if the extra few dollars a month buys them a UI they'll actually prefer using daily, since the best password manager is ultimately the one you don't fight with enough to stop using.

## Frequently asked questions

### Is Bitwarden's free plan actually usable, or is it a bait tier?

It's a real free plan. Bitwarden Free includes unlimited devices and unlimited saved vault items with no artificial cap pushing most individual users toward a paid plan, which is unusual in this category. You'd only need Premium for the integrated authenticator, larger encrypted file storage, or emergency access.

### Can I self-host 1Password instead of using its cloud service?

No. 1Password only operates as a cloud service today. Company staff have said on its community forum that self-hosting is something they are gathering demand for, but it is not currently offered at any price or tier, unlike Bitwarden, which supports self-hosting officially and through the community Vaultwarden project.

### Did the April 2026 Bitwarden CLI incident put vault passwords at risk?

Bitwarden's investigation found no evidence that vault data, production systems, or production data were affected. The compromise was limited to a malicious version of the Bitwarden CLI npm package distributed for roughly 90 minutes, and it targeted developer secrets like SSH keys and API tokens on machines that installed that specific package, not the browser extension or app most people use day to day.

### Which is cheaper for a small business, Bitwarden or 1Password?

Bitwarden, at every size we checked. Bitwarden Teams runs 4 dollars per user per month billed annually versus 1Password's Business tier at 8.99 dollars per user per month, and 1Password's small-team Teams Starter Pack is a flat 24.95 dollars a month for up to 10 members before per-seat pricing kicks in.

## Sources

- [Bitwarden pricing](https://bitwarden.com/pricing/?utm_source=guides.reviews&utm_medium=referral&utm_campaign=comparison) — Bitwarden
- [Bitwarden business pricing](https://bitwarden.com/pricing/business/?utm_source=guides.reviews&utm_medium=referral&utm_campaign=comparison) — Bitwarden
- [1Password business pricing](https://1password.com/business-pricing?utm_source=guides.reviews&utm_medium=referral&utm_campaign=comparison) — 1Password
- [1Password sign-up pricing](https://1password.com/sign-up?utm_source=guides.reviews&utm_medium=referral&utm_campaign=comparison) — 1Password
- [1Password SOC 2 reports](https://1password.com/resources/soc2?utm_source=guides.reviews&utm_medium=referral&utm_campaign=comparison) — 1Password
- [Bitwarden CLI compromised in ongoing npm supply chain attack](https://thehackernews.com/2026/04/bitwarden-cli-compromised-in-ongoing.html?utm_source=guides.reviews&utm_medium=referral&utm_campaign=comparison) — The Hacker News